From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:39878) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Y8sPl-0005rE-I6 for qemu-devel@nongnu.org; Wed, 07 Jan 2015 10:21:03 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Y8sPj-0003Bm-7L for qemu-devel@nongnu.org; Wed, 07 Jan 2015 10:20:53 -0500 From: Alexander Graf Date: Wed, 7 Jan 2015 16:20:25 +0100 Message-Id: <1420644048-16919-15-git-send-email-agraf@suse.de> In-Reply-To: <1420644048-16919-1-git-send-email-agraf@suse.de> References: <1420644048-16919-1-git-send-email-agraf@suse.de> Subject: [Qemu-devel] [PULL 14/37] spapr: Fix integer overflow during migration (TCG) List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-ppc@nongnu.org Cc: peter.maydell@linaro.org, Samuel Mendoza-Jonas , qemu-devel@nongnu.org From: Samuel Mendoza-Jonas The n_valid and n_invalid fields are unsigned short integers but it is possible to have more than 65535 entries in a contiguous hunk, overflowing the field. This results in an incorrect HTAB being sent to the destination during migration. Signed-off-by: Samuel Mendoza-Jonas Reviewed-by: Alexey Kardashevskiy Signed-off-by: Alexander Graf --- hw/ppc/spapr.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c index 869b721..765a44c 100644 --- a/hw/ppc/spapr.c +++ b/hw/ppc/spapr.c @@ -1065,7 +1065,7 @@ static void htab_save_first_pass(QEMUFile *f, sPAPREnvironment *spapr, /* Consume valid HPTEs */ chunkstart = index; - while ((index < htabslots) + while ((index < htabslots) && (index - chunkstart < USHRT_MAX) && HPTE_VALID(HPTE(spapr->htab, index))) { index++; CLEAN_HPTE(HPTE(spapr->htab, index)); @@ -1117,7 +1117,7 @@ static int htab_save_later_pass(QEMUFile *f, sPAPREnvironment *spapr, chunkstart = index; /* Consume valid dirty HPTEs */ - while ((index < htabslots) + while ((index < htabslots) && (index - chunkstart < USHRT_MAX) && HPTE_DIRTY(HPTE(spapr->htab, index)) && HPTE_VALID(HPTE(spapr->htab, index))) { CLEAN_HPTE(HPTE(spapr->htab, index)); @@ -1127,7 +1127,7 @@ static int htab_save_later_pass(QEMUFile *f, sPAPREnvironment *spapr, invalidstart = index; /* Consume invalid dirty HPTEs */ - while ((index < htabslots) + while ((index < htabslots) && (index - invalidstart < USHRT_MAX) && HPTE_DIRTY(HPTE(spapr->htab, index)) && !HPTE_VALID(HPTE(spapr->htab, index))) { CLEAN_HPTE(HPTE(spapr->htab, index)); -- 1.8.1.4